Weaknesses of type CWE-862

8,720 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2025-1299MEDIUMMissing Authorization in GitLabEPSS 0.3%CVE-2024-11844MEDIUMIdeaPush <= 8.71 - Missing Authorization to Board Term DeletionEPSS 0.3%CVE-2024-3602MEDIUMPop ups, Exit intent popups, email popups, banners, bars, countdowns and cart savers – Promolayer <= 1.1.0 - Missing AuthorizationEPSS 0.3%CVE-2024-12596MEDIUMLifterLMS – WP LMS for eLearning, Online Courses, & Quizzes <= 7.8.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post DeletionEPSS 0.3%CVE-2020-36890HIGHKentico Xperience <= 10 Administrator Access Control BypassEPSS 0.3%CVE-2026-56720MEDIUMCamaleonCMS 2.9.2 and earlier Missing Authorization via profile ActionEPSS 0.3%CVE-2024-10527LOWSpacer <= 3.0.7 - Missing Authorization to Authenticated (Subscriber+) Limited Information DisclosureEPSS 0.3%CVE-2023-39994MEDIUMWordPress ARMember Premium plugin <= 5.9.2 - Broken Access ControlEPSS 0.3%CVE-2026-77385MEDIUMKyoo: Transcoder serves uncataloged files from the media directoryEPSS 0.3%CVE-2026-33161LOWCraft CMS: Anonymous "assets/image-editor" calls returns private asset editor metadata to unauthorized usersEPSS 0.3%CVE-2026-25714MEDIUMGitea user organization API bypasses public-only token filteringEPSS 0.3%CVE-2026-82633MEDIUMDolibarr 10.0.0 before 24.0.0 Missing Authorization on REST Users Groups EndpointEPSS 0.3%CVE-2026-55547MEDIUMYamcs: Missing Authorization on Role and Privilege Enumeration Endpoints Allows Any Authenticated User to Disclose Full Security ConfigurationEPSS 0.3%CVE-2026-86342MEDIUMMISP Freetext Feed Preview Improper Authorization Exposes Restricted Event and Feed InformationEPSS 0.3%CVE-2024-45050HIGHRinger Server Does Not Check Members When Loading MessagesEPSS 0.3%CVE-2024-44052MEDIUMWordPress HelloAsso plugin <= 1.1.10 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-55703MEDIUMSnipe-IT: Maintenance Record Disclosure via Missing Authorization on GETEPSS 0.3%CVE-2025-22729MEDIUMWordPress VOD Infomaniak plugin <= 1.5.9 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-101923HIGHPhoto Reviews for WooCommerce <= 1.2.30 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'wcpr_image_upload_id' ParameterEPSS 0.3%CVE-2026-85574HIGHUnbounce Landing Pages 1.1.1 - 1.1.4 - Subscriber+ Reverse-Proxy Target Hijack via set_unbounce_domainsEPSS 0.3%